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AMENDMEPfTS TO THE CLAIMS 

This listing of claims will replace all prior versions of claims in the application: 
Listing of Claiim: 

] . (Cuirently amended) A computer implemented m ethod of detennining the location of an 
Intemet host using a computer system, comprising the following computer executable acts : 

obtaining route information relating to a network path between a host IP address 
associated with the Intemet host and the computer system, wherein the network path comprises 
the computer system, the Intemet host, and at least one intermediate networic node, [[,]] and 
wherein the route information comprises a plurality of router labels associated with the host IP 
address and the at least one intermediate network node; 

extracting a location code from the route information corresponding to a router label 
associated with one of the Internet host and an intermediate network node proximate the Intemet 
host; 

consulting a data store comprising at least one data set having location codes and 
corresponding location information; 

obtaining location information from the data store corresponding to the location code 
associated with the one of the Intemet host and the intemxediate network node proximate the 
Intemet host; 

providing a location estimate of the location of the Intemet host according to the location 
information from the data store corresponding to the location code; 

detemiining a delay time associated with a transmission from the computer system to 
receipt of the transmission at the Intemet host along the network path; and 

selectively correcting the location estimate according to tlie delay time associated with 
the network path, 

2. (Previously presented) The method of claim 1 , fiarther comprising extracting the location 
code by examining the router labels in route order along the path from the host to the computer 
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system imtil a location code is found that is usable to obtain location information firom the data 
store, 

3- (Previously presented) The method of claim 2, further comprising: 

determining a confidence metric representative of the accuracy of the location estimate; 

and 

selectively pxovidmg the location estimate of the location of the Internet host if the 
confidence metric exceeds a threshold. 

4. (Previously presented) The method of claim 3 ^ further comprising: 

determining a confidence metric representative of the accuracy of the location estimate 
based upon the delay time between the Internet host and the network node associated with the 
location estimate. 

5 . (Previously presented) The method of claim 1 , further comprising: 

obtaining route information relating to each network path between the host IP address 
and each of a plurality of computer systems, wherein the route information comprises a plurality 
of router labels associated with the host IP address, and each of the plurality of computer 
systems, and at least one intermediate network node in each network path; 

extracting a location code for each network path fi-om the route infbmaation 
corresponding to a router label associated with one of the Internet host and the at least one 
intermediate network node in each network path; 

obtaining location information fiom the data store corresponding to each location code; 

providing a plurality of location estimates of the location of the Internet host according to 
the location information fi'om the data store corresponding to each location code; and 

correlating at least two of the location estimates to provide an improved location estimate 
of the location of the Internet host 

6. (Original) The method of claim 1 , wherein the location code comprises one of a city 
code, and airport code, and a country code^ and wherein obtaining the route information 
comprises using a traceroute tool. 
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7- (Currently Amended) A software tool for detenmning the location of an Internet host 
using a computer system, comprising the following computer executahle components : 

a route trace component adapted to obtain route information relating to a networic path 
between a host IP address associated with the Internet host and the computer system, wherein the 
first network path comprises the computer system, the Internet host, and at least one intermediate 
network node, and wherein the route information comprises a plurality of router labels associated 
with the host IP address and the at least one intermediate network node; 

an extraction component adapted to extract a location code fixwn the route information 
corresponding to a router label associated with one of the Intemet host and an intermediate 
network node proximate the Intemet host; 

a data store comprising at least one data set having location codes and corresponding 
location information; 

an estimation component adapted to obtain location information jfrom the data store 
corresponding to the location code associated with the one of the Internet host and the 
intermediate network node proximate the Intemet host, and to provide a location estimate of the 
location of the Intemet host according to the location information from the data store 
corresponding to the location code;. 

a correction component to determine a delay time associated with a transmission firom the 
computer system to receipt of the transmission at the Intemet host along the network path and 
selectively correct the location estimate according to the delay time associated with the network 
path. 

8. (Currently Amended) A computer-readable mediinn having computer-executable 
instmctions for: 

obtaining route information relating to a network path between a host IP address 
associated with an Internet host and a computer system, wherein the network path comprises the 
computer system, the Intemet host, and at least one intermediate network node, and wherein the 
route information comprises a plurality of router labels associated with the host IP address and 
the at least one intermediate network node; 
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extracting a location code from the route mfoimation coiresponding to a router label 
associated with one of the Internet host and an intermediate network node proximate the Ihtemel 
host; 

consulting a data store comprising at least one data set having location codes and 
corresponding location infonnation; 

obtaining location infonnation from ttxe data store corresponding to the location code 
associated with the one of the Internet host and the intermediate network node proximate the 
Internet host; 

providing a location estimate of the location of the Intemet host according to the location 
information from the data store corresponding to the location code; 

determining a delay time associated with a transmission from the computer system to 
receipt of the transmission at the Intemet host along the network path; and 

selectively correcting the location estimate according to the delay time associated with 
the network path, 

9. (Currently Amended) A computer implemented system for determining the location of an 
Intemet host, comprising the following computer executable components : 

a first component operating in a computer system to obtain route information relating to a 
network path between a host IP address associated with the Intemet host and the computer 
system, wherein the first network path comprises the computer system, the Intemet host, and at 
least one intermediate network node, and wherein the route irtformation comprises a plurality of 
router labels associated with the host IP address and the at least one intermediate network node; 

a second component operating in the computer system to extract a location code from the 
route information corresponding to a router label associated with one of the Intemet host and an 
intermediate network node proximate the Intemet host; 

a third component operating in the computer system to consult a data store comprising at 
least one data set having location codes and corresponding location information; 

a fourth component operating in the computer system to obtain location information from 
the data store coiresponding to the location code associated with the one of the Intemet host and 
the intermediate network node proximate the Intemet host; 
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a fifth ooTsaponent operatuiig in the computer system to provide a location estimate of the 
location of the Internet host according to the location information from the data store 
corresponding to the location code; and 

a sixth component operating in the computer system to detemiine a delay time associated 
with a trmsmission from the computer system to receipt of the transmission at the Internet host 
along the network path and selectively correct the location estimate according to the delay time 
associated with the network path. 

10. (Cmrently Amended) Geographical location estimate data associated with an Internet 
host, the estimate data resulting from a process executiiig on a computer system^ comprising the 
following computer executable acts : 

obtaining route information relating to a network path between a host JOP address 
associated with the Internet host and a computer system, wherein the network path comprises the 
computer system, the Internet host, and at least one intermediate network node, and wherein the 
route information comprises a plurality of router labels associated with the host IP address and 
the at least one intermediate network node; 

extracting a location code from the route information corresponding to a router label 
associated with one of the Internet host and an intermediate network node proximate the Internet 
host; 

consulting a data store comprising at least one data set having location codes and 
corresponding location information; 

obtaining location information from the data store corresponding to the location code 
associated with the one of the Internet host and the intermediate network node proximate the 
Intemet host; and 

providing a location estimate of the location of the Intemet host according to the location 
information from the data store corresponding to the location code; 

deteiinining a delay time associated with a transmission from the computer system to 
receipt of the transmission at the Intemet host along the network path; and 

selectively correcting the location estimate according to the delay time associated with 
the network path. 
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1 1 . (Currently Amended) A computer implemented m ethod of detennining the location of an 
Intemet host using multiple computer systems, comprising the foUowinp computer executable 
acts : 

obtaining route information relating to a plurality of network paths between a host IP 
address associated with the Intemet host and a corresponding plurality of computer systems, 
respectively, wherein the plurality of network paths individually comprise a corresponding 
computer system, the Xntemet host, and at least one inteimediate network node, and wherein the 
route information comprises a plurality of router labels associated with the host BP address and 
an intennediate network node; 

extracting a location code from the route information corresponding to a router label 
associated with one of the Intemet host and an intermediate network node proximate the luteraet 
host; 

consulting a data store comprising at least one data set having location codes and 
corresponding location infomiation; 

obtaining location information from the data store corresponding to the location code 
associated with the one of the Intemet host and the interaiediate network node proximate the 
Intemet host; 

providing a location estimate of the location of the Intemet host according to the location 
information. 

determining a delay time associated with a transmission from the computer system to 
receipt of the transmission at the Intemet host along at least one of the network paths; and 
selectively correcting tlie location estimate according to the delay time. 

12. (Currently Amended) A computer implemented method of determining the location of an 
Intemet host using a first computer system, comprising the following computer executable acts : 

measuring a first delay time relating to a tran-wir ^sion from the first computer system to 
receipt of the transmission at the Intemet host along a first network path between a host IP 
address associated with the Intemet host and the first computer system; 

measoiing a second delay time relating to a transmission from a second computer system 
to receipt of the transmission at the Intemet host alon^ a second network path between the host 
IP address and [[a]] tte second computer system; 
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measuring a third delay time relating to a transmission from a third computer system to 
receipt of the transmission at the Internet host along a third network path between the host IP 
address and [[a]] the third computer syste m, at least one of the first second, and third network 
•paths containing at least one intermediate node : 

correlating the first, second, and third delay times; and 

providing a location estimate of the location of the Internet host according to the 
correlation of the first, second, and third delay times. 

13. (Original) The method of claim 12, wherein correlating the first> second, and ttiird delay 
times comprises triangulating the first, second, and third delay measurements. 

14. (Origiaal) The method of claim 12, wherein correlating the first, second, and third delay 
times comprises: 

consulting a data store comprising N sets of first, second, and third delay measurements 
between the first, second, and third computer systems, respectively, and N known hosts, as well 
as location information associated with the N known hosts, wherein N is an integer, 

performing a comparison of the first, second, and third delay times with the N sets of 
first, second, and third delay measurements in the data store; 

determining a nearest set of first, second, and third delay measurements according to the 
comparison; and 

providing a location estimate of the Internet host according to the nearest set of first, 
second, and third delay measurements. 

15. (Original) The method of claim 14, wherein performing the comparison of the first, 
second, and third delay times with the N sets of first, second, and third delay measurements in 
the data store comprises determining N Euclidian distances corresponding to the Euclidian 
distances between the N sets of first, second, and third delay measurements in the data store and 
the first, second, and third delay times, and wherein providing a location estimate of the Intemet 
host according to the nearest set of first, second, and third delay measurements comprises 
selecting location infonnation associated with the set of first, second, and third delay 
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measuTOTieiits in the data store associated with the smallest BucUdiaa distance as the location 
estimate. 

16, (Original) The method of claim 12, 

w^herein correlating the first, second, and third delay times comprises: 

computing a first probability density jfiinction establishing a relationship between a first 

network delay associated with the first computer system and a first distance fix>m the first 

computer system; 

detenniiung a first distance estimate representative of the distance between the first 
computer system and the location of the Internet host using the first delay time and the first 
probabihty density function; 

computing a second probability density function establishing a relationship between a 
second network delay associated with the second computer system and a second distance fi'om 
the second computer system; 

detemaining a second distance estimate representative of the distance between the second 
computer system and the location of the Internet host using the second delay time and the second 
probability density function; 

computing a third probability density function establishing a relationship between a third 
network delay associated with the third computer system and a third distance from the third 
computer system; and 

determining a third distance estimate representative of the distance between the third 
computer system and the location of the Intemet host using the third delay time and the third 
probability density function; 

and wherein providing the location estimate comprises triangulating the first, second, and 
third distance estimates. 

17- (Original) The method of claim 16, wherein determining the first, second, and third 
distance estimates further comprises computing an error function over a location space, and 
determining coordinates within the location space where the error function is minimized. 
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1 8. (Original) The method of claim 1 7, wherein determining coordinates within the location 
space where the error function is ininimized comprises minimizing the error function across a list 
of known city locations, and wherein providing the location estimate comprises providing the 
known city location corresponding with the minimum value of the error function. 

1 9. (Original) The method of claim 1 8, wherein computing the error function comprises 
using a weighted least mean squares algorithm to optimize the location estimate. 

20. (Original) The metliod of claim 18, wherein computing the error function comprises 
using a probabihty density estimation to optimize the location estimate. 

21. (Original) The method of claim 18, wherein computing the error function comprises 
using a weighted least mean squares algorithm to prune a solution space, and using a probability 
density estimation to optimize the location estimate from the pruned solution space. 

22. (Original) The method of claim 18, wherein computing the error function comprises 
using a probability density estimation to prune a solution space, and tising a weighted least mean 
squares algorithm to optimize the location estimate from the pruned solution space. 

23 . (CuTxently Amended) A software tool for determining the location of an Internet host 
using a first computer system, comprising the following computer executable components : 

a first delay component adapted to measure a first delay time relating to a transmission 
from the first computer system to receipt of the transmission at the Intemet host along a first 
network path between a host IP address associated with the Internet host and the first computer 
system; 

a second delay component adapted to measure a second delay time relating to a 
transmissio n from a second computer system to receipt of the transmission at the Intemet host 
alonp a second network path between the host IP address and [[a]] the second computer system; 

a third delay component adapted to measure a third delay time relating to a transmission 
frnm fl thir d computer system to receipt of the transmission at the Intemet host along a third 
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network patti between the host IP address and [[a]] tfie third computer syste m, at least one of the 
first, second and third network paths containing at least one intemiediate node : 

a correlation component adapted to correlate the first, second, and ttiird delay times; and 
an estimation component adapted to provide a location estimate of the location of the 
Internet host according to the correlation of the first, second, and third delay times. 

24. (Currently Amended) A computer-readable medium having computer-executable 
instructions for: 

measuring a first delay time relating to a transmission fi:om a first computer system to 
receipt of the transmission at an Internet host alonp a first network path between a host IP 
address associated with the Intemet host and the first computer system; 

measuiing a second delay time relating to a transmission fi:om a second computer system 
to receipt of the transmission at the Intemet host along a second network path between the host 
IP address and [[a]] flie second computer system; 

measuring a third delay time relating to a transmission jfirom the Intemet host to receipt of 
the transmission at a third computer system along a third network path between the host BP 
address associated with the Intemet host and a third computer syste m, at least one of the first 
second and third network oaths containing at least one intermediate node : 

coirelating the first, second, and third delay times; and 

providing a location estimate of the location of the Intemet host according to the 
correlation of the first, second, and third delay times. 

25. (Currently Amended) A computer implemented system for determining the location of an 
Intemet host, comprising the following computer executable components : 

a first component operating in a first computer system to measure a first delay time 
relating to a transmission fi?om the first computer system to receipt of the transmission at the 
Internet host along a first network path between a host IP address associated with the Intemet 
host and the first computer system; 

a second component operating to measure a second delay time relating to a transmission 
fix>m a second computer system to receipt of the transmission at tbe Intemet host alonp a second 
network path between the host IP address and [[a]] tfie second computer system; 
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a third component operating to measure a third delay time relating to a transmission firoTu 
a third computer system to receipt of flie transmission at the Intemet host along a third network 
path between the host IP address and [[a]] ^ third computer syste m, at least one of the fir^ 
second, and third network paths containing at least one intermediate node ; 

a fourth component operating to correlate the first, second, and third delay times; and 
a fifth component operating in a jfirst computer system to provide a location estimate of 
the location of the Intemet host according to the correlation of the first, second, and third delay 
times. 

26. (Currently Amended) Geographical location estimate data associated with an Intemet 
host, the estimate data resulting from a process executing on a computer system, comprising tte 
following computer executable acts : 

measuring a first delay time relating to a transmission from a first computer system to 
receipt of the transmission at the Intemet host along a first network path between a host IP 
address associated with the Intemet host and [[a]] the first computer system; 

measuring a second delay time relating to a transmission from a second computer system 
to receipt of the transmission at the Intemet host along a second network path between the host 
IP address and [[a]] the second computer system; 

measuring a third delay time relating to a transmission firom a third computer system to 
receipt of the transmission at the Intemet host along a third network path between the host IP 
address and [[a]] ttie third computer syste m, at least one of the first second, and third network 
paths containing at least one intemiediate node : 

correlating the first, second, and third delay times; and 

providing a location estimate of the location of the Intemet host according to the 
correlation of the first, second, and third delay times. 

27. (Currently Amended) A method of determining the location of an Internet host using a 
first computer system, comprising the following computer executable acts : 

obtaining partial IP-to-location mapping information firom a data source; 
obtaiiung network routing information; 
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clustering together IP addresses corresponding to hosts in the same geographic location 
according to network routing information to obtain cluster information; 

correlating the partial IP-to-location information with the cluster information 

providing a location estimate of the location of the Internet host according to the 
correlation of the partial P-to-location infonnation and the cluster information; and 

computing a dispersion metric representative of the accuracy of the location estimate of 
the location of the Internet host. 

28. (Original) The method of claim 27, wheretQ obtaining network routir^ infonnation 
comprises using a routing protocoL 

29. (Original) The method of claim 28, wherein the routing protocol is one of BGP, RIP, 
OSPF, IGRP, and EGP. 

30. (Original) The method of claim 27, wherein clustering together IP addresses 
corresponding to hosts in the same geographic location according to network routing infoimation 
to obtain cluster information comprises associating an address prefix used by a routing protocol 
with a geographical location. 

3 1 . (OrigLoal) The method of claim 30, further comprising: 

sub-dividing the geographical location associated with the address prefix into at least two 
clusters according to a geographical spread associated with the geographical location. 

32. (Original) The method of claim 27, further comprising sub-dividing the cluster 
information according to a geographical spread associated with the geogr^hical location. 

33. (Previously presented) The method of claim 27, further comprising selectively providing 
the location estimate if the dispersion metric is less than a threshold value. 

34. (Previously presented) The method of claim 33, further comprising a threshold value that 
is dependent on the size of the cluster. 
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35. (Original) The method of claim 27, further comprising: 

obtaimmg route infonnation relating to a first network path between a host IP address 
associated with the Intemet host and the first computer system, wherein the first network path 
comprises the first computer system, the Intemet host, and at least one intermediate network 
node, and wherein the route infonnation comprises a plurality of roirter labels associated with the 
host IP address and the at least one intermediate network node; 

extracting a first location code fi:om the route information corresponding to a router label 
associated with one of the Internet host and an intermediate network node proximate the Intemet 
host- 
consulting a data store comprising at least one data set having location codes and 
corresponding location information; 

obtaining first location information fit)m the data store corresponding to the first location 
code associated with the one of the Intemet host and the intermediate networic node proximate 
the Intemet host; and 

providing a first location estimate of the location of the Intemet host according to the first 
location infonnation fix)m the data store corresponding to the first location code. 

36. (Currentiy Amended) The method of claim 35, finther comprising: 

measuring a first delay time relating to a transinfqsion Scorn the first comnnter system to 
receipt of the transmission at the Intemet host along a first network path between a host IP 
address associated witli the Intemet host and the first computer system; 

measuring a second delay time relating to a transmission from a second computer system 
to receipt of the transmission at the Internet host along a second network path between the host 
IP address and [[a]] the second computer system; 

measuring a third delay time relating to a transmission fi-om a third computer system to 
receipt of the transmission at the Intemet host alone a third network path between the host IP 
address and [[a]] the third computer syste m, at least one of the first, second, and third network 
paths containing at least one intermediate node : 

correlating the first, second, and third delay times; and 
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providing a location estimate of the location of the Internet host according to the 
correlation of the first, second, and third delay times. 

37. (Currently Amendedl) The method of claim 27, further comprising: 

measuring a first delay time relatixig to a transmission from the first computer system to 
receipt of the transmission at the Icitemet host along a first network path between a host IP 
address associated with the Internet host and the first computer system; 

measuring a second delay time relating to a transmission from a secondcomputer system 
to receipt of the transmission at the Internet host along a second network path between the host 
IP address and [[a]] ttie second computer system; 

measuring a third delay time relating to a transmission from a third computer system to 
receipt of the, transmission at the Internet host alonp a third network path between the host IP 
address and [[a]] flie third computer system , at least one of the first, second, and third network 
paths containing at least one intermediate node; 

correlating the first, second, and third delay times; and 

providing a location estimate of the location of the Intemet host according to the 
correlation of the first, second, and third delay times. 

38. (Currently Amended) A software tool for determining the location of an Intemet host 
using a first computer system, comprising the following computer executable components : 

a first component adapted to obtain partial IP-to-location mapping information fix)m a 
data source; 

a routing protocol component adapted to obtain network routing inffaimation; 

a clustering component adapted to cluster together IP addresses corresponding to hosts in 
the same geographic location according to network routing information to obtain cluster 
information; 

a correlation component adapted to correlate the partial IP-to-location information with 
the cluster information; 

an estimation component ad^ted to provide a location estimate of the location of the 
Intemet host according to the correlation of tlie partial IP-to-location information and the cluster 
information; and 
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a correction component to compute a dispersion metric representative of the accuracy of 
the location estimate of the location of the Internet host and selectively providing the location 
estimate. 

39. (Previously presented) A computer-readable medium having coniputer-executable 
instmctions for: 

obtaining partial IP-to-location moping information from a data source; 
obtaining network routing information; 

clustering together IP addresses corresponding to hosts in the same geographic location 
according to network routing information to obtain cluster information; 

correlating the partial IP-to-location information with the cluster information; 

providing a location estimate of the location of the Intemet host according to the 
correlation of the partial IP-to-location information and the cluster information; and 

calculating a dispersion metric representative of the accuracy of the location estimate of 
the location of the Intemet host and selectively providing the location estimate. 

40. (Currently Amended) A computer implemented system for determining the location of an 
Intemet host, comprising the following computer executable components : 

a first component operating to obtain partial IP-to-location mapping infomiation from a 
data source; 

a second component operating to obtain network routing information; 

a third component operating to cluster together IP addresses coiresponding to hosts in the 
same geographic location according to network routing information to obtain cluster 
information; 

a fourth component operating to correlate the partial IP-to-location information with the 
cluster information; 

a fifth component operating to provide a location estimate of the location of the Intemet 
host according to the correlation of the partial P-to-location information and the cluster 
information; and 
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a sixth component operatiitg to calculate a dispersion metric representative of the 
accuracy of the location estimate of the location of the Internet host and selectively providing the 
location estimate. 

41 . (Currently Amended) Geographical location estimate data associated with an Internet 
host, the estimate data resulting fix)m a process executing on a computer system, comprising the 
following computer executable acts : 

obtaining partial IP-to-location mapping information from a data source; 

obtaining network routing information; 

clustering together IP addresses corresponding to hosts in the same geographic location 
according to network routing information to obtain cluster information; 

correlating the partial IP-to-Iocalion information with the cluster infoimation; 

providing a location estimate of the location of the Internet host according to the 
correlation of the partial IP-to-location information and the cluster information; and 

computing a dispersion metric representative of the accuracy of the location estimate of 
the location of the Intemet host and selectively providing the location estimate. 
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